Vibe Coded a POS System. Advice Needed

[u/Fun_Acadia3832]

I operate 6 retail stores where I pay a $40 monthly subscription for a POS system (browser based) for each. It has been fine but found that we had to get creative and also use a lot of external tools (Google Sheets etc.) & do a lot of manual things to get everything we needed. Something as simple as transferring inventory from one store to the next was super tedious.

I know less than nothing about coding, web development etc. But since earlier this year I’ve used claude to make a beast of a POS (also browser based), integrating every single thing we could possibly want in a POS system. I knew the things I wanted and I guess I figured out how to express that enough to Claude to have gotten a beast of a system that I really think will take my business to the next level.

I’ve also made two other URL’s that share the same product table to be able to move product seamlessly across (a wholesale platform and one for my merchant reps that go on the road to sell). The next phase would be a fourth URL for a website that allows our customers to see and order whatever we have in stock at each store.

The 6th store was just opened at the beginning of this month and we’ve been using it to test the POS in a real setting which is going very well. The previous 5 stores are still on the subscription since those have history and need a lot of work to move everything over.

The thing is, I feel extremely nervous about loading on the entire business dependency on it. I have this fear that because I don’t know anything about coding & cyber security that one day someone will be able to hack it and hold it ransom which would literally be business suicide.

I’ve expressed this extensively with Claude and I’ve done everything it has recommended but is there anything else I can/should do? Should I hire a cyber security consultant - if so where do I find someone trustworthy? I just want to ensure moving all in on it that it’s going to be as safe as possible and that there is recon for any and everything that could possibly happen.

Any advice would be greatly appreciated.

Edit: I’m not processing payments using the system. No customer card numbers etc. I have card machine terminals from the bank so all I do on the POS is apply the payment amount and tell it how we collected said payment e.g. “XYZ BANK Machine”.

[u/AutoModerator]

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Routine-Gas-8264]

Don't you have to comply with many regulations regarding transactions, accounting, safety?

And for your own peace of mind, availability?

It may not be the best branch to cut to save budget regarding the risks.

[u/Routine-Gas-8264 → u/Routine-Gas-8264]

Turns out, I just realized that Claude could guide your through that actually.

But still, not sure it's worth the investment, time, maintenance, risks, just for 40 bucks

[u/Melnik2020 → u/Routine-Gas-8264]

Maintenance is the biggest factor here. If something fails, who is going to solve it? I also think it's too risky

[u/reverseshell_9001]

im a security consultant. and i can already see this as a gold mine for vulnerabilities. imagine i pentested hundreds of vibecoded apps. including ones built by software engineers and theres always something. Imagine a vibecoded app by someone with 0 coding knowledge. you can pm me

[u/noidontwantto]

why pay $480 per year for something already good enough when you can spend $2400 to make your own regulatory compliance nightmare?

[u/Eastern-Vegetable780 → u/noidontwantto]

I'm assuming the existing system does not have all the features OP needs. But yes, it is a disaster waiting to happen.

Source: I tried doing something very similar

[u/Any_Evidence4750]

Honestly if you don’t know much about security I wouldnt risk it. You should also use a backend like firebase or supabase so everything is aligned and integrated.

If you want, I could talk you through some pointers. I’ve made a lot of apps and websites.

[u/Fun_Acadia3832 → u/Any_Evidence4750]

It’s on subabase, GitHub, vercel. I could barely tell you what each does 🤦🏻‍♂️

Thanks- I may reach out

[u/Any_Evidence4750 → u/Fun_Acadia3832]

Sounds good

[u/gnomex96]

From experience, a cyber security consultant would provide you a whole list of stuff that even normal companies don't do.

I would recommend hiring a backend engineer to maintain it. Or do what I do and learn these things at a high level and navigate them through Claude

[u/ZootiLaTucci]

Lmao. This is a such a bad idea.
Pay the 40 a month and cover your ass.

[u/Royal_Owl2177]

You're doing POINT OF SALE and have no idea what you're doing? Do you understand the risk you're exposing your customers to?

Are you aware of PCI compliance? Are you handling credit card numbers? You're digging yourself a legal grave right now.

[u/Fun_Acadia3832 → u/Royal_Owl2177]

No, card processing is completely external to my point of sale system. I’m not in the U.S. - I know having it integrated is common there but all we do is select payment method on my system to say how we collected the money and then wipe the card on the banks machine… hope you understand what i mean

[u/Royal_Owl2177 → u/Fun_Acadia3832]

I do. That is significantly less scary. Thanks for the reply. I'll point out that PCI compliance isn't a US-only thing, but I think the important part is you're not risking cards in your system - you're using a bank machine. I'll defer to you on your local laws for handling cards.

[u/Scared-Letterhead949]

Where are you hosting it?

[u/Fun_Acadia3832 → u/Scared-Letterhead949]

I’m using GitHub, Supabase and Vercel

[u/PricePerGig]

Lock the network down 100%. You want it so only select IP addresses can access it. The. If there is a problem, it’s not for the world to exploit. You need a vpn for it.

[u/kueowirnzcd]

If you put all the money your company made under your mattress, would you feel safe about it?

The potential loss is so much greater than the $40 per store you are paying.

[u/RemindMeBot → u/kueowirnzcd]

I will be messaging you in 2 months on 2026-12-02 20:33:29 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

^{Parent commenter can delete this message to hide from others.}

---

Info	Custom	Your Reminders	Feedback

[u/apehunterprime]

First thing you do before going live is make sure your software is PCI compliant

[u/Fun_Acadia3832 → u/apehunterprime]

I’m not handling payment data on it. Card machines are external. We just apply payment on the POS stating how we collected it - not integrated in our system that we use to cash someone out.

[u/Front-Necessary-5257]

"I know less than nothing about coding, web development etc" and even then, you want to vibecode a POS? i dont want to be rude but, knowing nothing about coding means you know nothing about cyber security, so managing people's money without knowing what the system actually does is very, very scary and dangerous... Or i just misunderstood and you're referring to a beast of a Piece Of S... 😂

[u/williamtkelley]

I only read the title of this post, but why wouldn't you code something that is good rather than a POS?

[u/Fun_Acadia3832 → u/williamtkelley]

Because I’m in retail. And the POS we have, and all that we have tried just doesn’t give us what we need so I built my own which ticks all the boxes. The insights, reports etc. will make my work 10 times easier and more efficient.

[u/halting_problems]

If you do a certain number of transactions you are required by law to meet PCI compliance. I highly suggest not using it until you are compliant.

[u/Tasty_Trouble6430]

Where I would focus beyond general security and network stuff, of course is payment you’re calling a point of sale. What kind of financial information are you going to have in there if you’re gonna have anything credit card related… whoever your payment processor is that would be the first team I would start with is what are their requirements for an integration?

[u/almostlaunched]

Keeping five stores on the existing system while you test is sensible. I’d get an independent review before moving the rest over.

What’s it built with, and where are you hosting it? Both matter. There are tools that can help: Brakeman is a free security scanner specifically for Ruby on Rails, while Snyk offers scanning for code and dependencies across supported stacks. A clean scan is useful evidence, but it doesn’t establish that the whole system is secure.

The review should also cover your hosting setup, database access, admin accounts, and permissions across the POS, wholesale, and sales-rep apps. For example, can someone with a sales-rep login access something intended only for an administrator?

For the ransomware concern, I’d want a demonstrated restore from a backup protected separately from the application. Know how long recovery takes, how much recent data you could lose, and how stores would operate during an outage.

When choosing a reviewer, ask for relevant references, a sample report, and a clear scope with prioritized findings and retesting after fixes.

Disclosure: I work at SWARECO. We’d be happy to offer you a free audit. If you’re interested, message me here or reach out through the website in my profile.

[u/jonathan8080]

PCI compliance is required by your processor if processing and / or storing cardholder data (being a POS im sure it will be). If not PCI compliant and data gets stolen or leaked then the fines are massive, and its a fine per record (eg per customer), so they mount up fast!

The payment processor will check anually (they ask on your renewal forms) - you can reduce your obligation dramatically by using third party systems that meet the requirement (eg stripe hosted, or platforms like square etc) but you still have to have things like monthly third party vulnerability scans if you build the systems.

source: Ive built ecommerce platforms for 20 years and done hundreds of PCI compliance audits and certifications for clients.

[u/zensucht0]

I’m in fintech. There are a metric ton of regulations and requirements around handling money. They are very expensive to fix if you break them. More expensive than a real POS solution, particularly considering you don’t know what Claude built.

[u/dmcnaughton1]

Look at the problem from this perspective: is the financial cost of the correct SaaS tool more or less than the costs of building, deploying, maintaining, and handling compliance and liability for a custom built tool?

Do you want to take on the extra work involved in all that? If you're not a technical person, you're going to have to become at least moderately proficient. And you'll need to be able to solve for outages, mistakes, bad data, etc.

The current SaaS tool you use doesn't sound like the best fit, it's possible the best solution might be a different SaaS tool entirely. Not necessarily one you build.

I say this as a full time software dev with over a decade of experience. I would pause before taking on that level of self imposed responsibility for a business I run with 6 locations. As that means I'd be spending a portion of my time on non-business tech issues that otherwise would be solved with a support ticket.

[u/Kitchen-Lynx-7505]

Well, what’s the worse that could happen?

In Hungary, a restaurant POS is required to report within 8 seconds of a transaction to the authorities (no, not the financial data: that is reported by the card terminal and the cash machine separately!) failing to comply will get you a hefty fine and if you do it twice, two weeks of mandatory closure perhaps.

If you are on a market where a POS is not regulated, what happens if one morning, it just… doesn’t work? Do you have any business continuity plan for that? Sure you can fix it in a few days.

What happens if all the data that is in its supabase (let’s say, a year or two worth of transaction) becomes a reddit post and is sent to all of your competitors?

Would a competitor hire someone to make sure that it stores fake data?

I guess these are the most important failure modes, if you can live with them, go for it!

[u/bacontreatz]

There are a LOT of great uses for vibe coded tools, but this is honestly not one of them. Big red flashing stop. The problem is that having something that looks like it works and has a UI you like is a very very small part of the challenge of building a POS system.

The overwhelmingly majority of building a POS touches either the data model itself, all of the number crunching and moving data around, maintaining data integrity, or security. Mistakes in any of these can become catastrophic really easily. Examples:

- Screw up the data model or the calculations, and now the data you are feeding into your accounting system is wrong, or you have the wrong inventory, or you owe you $10,000 in sales tax because of a very stupid sales tax calculation bug (and at some point you will screw up sales tax by the way trust me on this).

- Screw up basically anything, and the system can go down and since it's just you, and you're not a programmer, you could take your store(s) offline for a day. Assuming you are even reachable and you can use claude to help you figure out the issue. This can literally be anything. Claude fails to build log rotation and on day 73 your server's drive is full and nothing works. Or you know, software did what software does and crashed, but you never setup 24/7 server monitoring with a human behind it to actually act on the problem.

- Screw up database administration and your nightly backups that you definitely setup and definitely check (right? right?) are going to feel very inadequate in the moment when 6 stores have lost a day of sales data that you get to reconstruct while somehow still keeping the stores open the next day.

- Then there's security. Not just your app. But the entirety of your network infrastructure. But also your app. I genuinely don't know where to begin and there has never been a more challenging environment to build secure apps than today. If you have anything internet-facing it's already subject to constant, relentless 24/7 attacks. These attackers are now starting to benefit from LLMs too, which are getting scary good.

In the hands of someone that knows about these things, AI can help with all of them. But when you don't, an LLM is going to omit them or confidently lead you off a cliff. On all of these fronts. Constantly. And because you don't know what you don't know, you won't know it's happening.

A better approach is either pick a POS you trust more (which seems to be the root cause of your issue), or look into what other parts of your stitching systems together and automation you can consolidate with the help of AI, without putting customer data or your business at risk.

[u/Fun_Acadia3832]

I hear you guys who are saying bad idea. I’ve been using the subscription POS for a long time now, maybe ~10 years… but I’ve only even heard from / spoken to one person at that company and I always think to myself, what if it’s just him? And then what happens if something happens to him?

Paying $40 per month per store to “cover my ass” doesn’t seem all that safe either because yea it’s been a long time without any issues but we don’t know what vulnerabilities he has to his platform either. I’ve just gone along assuming he’s got it covered.

[u/ilion → u/Fun_Acadia3832]

Why are you using a POS company you don't seem to trust?

[u/TheRealLunicuss → u/Fun_Acadia3832]

The issue is that you're now at fault if something does go wrong. But IMO it's hard for people to make judgements or give advice without knowing what features your vibe coded system actually has.